3rd party applications with code open to inspection allows security flaws to be more readily identified and patched. 3rd party applications are generally being run with very limited permissions on the UNIX model -I can't say that has always been the case with other platforms.
I may also be guilty of taking the suite of applications collectively and calling them an OS, as many users commonly do, leading me to suppose that just about everything other than the base OS kernel could be called a 3rd party application. At what point is the cut off --compiled drivers are OS but module drivers are 3rd party?
Anyway, my basic point was that security in obscurity is a myth - Linux-os-suite-of-applications are hardly obscure to hackers, but perhaps a little more abstruse to the script kiddies.